PT-2010-5159 · Eucalyptus · Eucalyptus

Published 2010-12-22 · Updated 2017-08-17 · CVE-2010-3905

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eucalyptus versions 2.0.0 through 2.0.1

Description The issue concerns the password reset feature in the administrator interface, which fails to perform authentication. This allows remote attackers to send password reset requests for other users, potentially gaining privileges.

Recommendations For Eucalyptus versions 2.0.0 and 2.0.1, consider disabling the password reset feature in the administrator interface until a fix is available to prevent unauthorized access.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-3905

Affected Products

Eucalyptus

References · 9

• http://vupen.com/english/advisories/2010/3259 · Vendor Advisory
• http://vupen.com/english/advisories/2010/3260 · Vendor Advisory
• http://secunia.com/advisories/42632 · Vendor Advisory
• http://secunia.com/advisories/42666 · Vendor Advisory
• http://ubuntu.com/usn/USN-1033-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3905 · Security Note
• http://open.eucalyptus.com/wiki/esa-01 · Note
• http://securityfocus.com/bid/45462 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64167 · Note